CVE-2026-118170: Npm/@strapi/review-workflows vulnerability
Published Oct 27, 2026
·Updated
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
Affected Software
1 affected component
npm/@strapi/review-workflows
Event History
Oct 27, 2026
CVE Published
via MITRE·06:02 PM
Data Sourced
via MITRE·06:02 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Deployments using the strapi/review-workflows package should be reviewed, particularly where callers can trigger updates to underlying documents. The issue concerns callers who do not have update rights for those documents.
2
Where can teams find the referenced release information?
The provided reference points to the Strapi release notes for release v5.51.0.